LlamaIndex: Connect LLMs to Your Data (GitHub, Scanned)

LlamaIndex is a Python framework for putting your own data in front of a language model. It loads documents from files, APIs and databases, splits and embeds them, stores them in an index, and gives you retrievers, query engines and agents on top, with the five-line version (read a folder, build a vector index, ask it questions) genuinely five lines. Everything past the core is a separate pip package: more than 300 integrations for models, embeddings, vector stores and data readers, installed only when you need them.

It is on the list as the other long-standing framework beside LangChain, with a stronger lean toward retrieval and document handling. It is MIT-licensed with about 2,000 contributors. One thing to know: the README now says the company's primary focus has moved to LlamaParse, its paid document-parsing platform, and that the open-source framework remains available as a toolkit. It is still released regularly, but that is a signal about where new effort goes.

• Repository: github.com/run-llama/llama_index
• Licence: MIT (MIT License)
• Language: Python. Stars: 52.3K. Forks: 8,227. Last push: Sep 27, 2026.
• Scan: safe, Sep 25, 2026, commit 169e450

Who it is for

Python developers building question answering, search or agents over their own documents, and teams that want to pick each component (model, embedder, vector store) independently.

Getting started

1. Install the starter bundle: the core plus OpenAI model and embedding integrations

pip install llama-index

2. Or build from the core and pick integrations, here for fully local models

pip install llama-index-core llama-index-llms-ollama llama-index-embeddings-huggingface

3. Index a folder of documents (set OPENAI_API_KEY first)

python -c "from llama_index.core import VectorStoreIndex, SimpleDirectoryReader; VectorStoreIndex.from_documents(SimpleDirectoryReader('data').load_data())"

Safety scan

We cloned run-llama/llama_index at commit 169e450 on Sep 25, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• One secret-shaped string, a placeholder GitHub token padded with x characters in the GitHub reader demo notebook. No self-decoding code, no bare-IP URLs.
• The pattern hits are all in example notebooks and tests: five notebooks quote a vendor's curl | sh installer for NebulaGraph, Memgraph or JaguarDB as a setup step for that demo, and the hex-escape runs are small audio file headers used as test data.
• No install hooks, installer scripts or committed binaries.
• Known advisories: 264 across 2,392 packages, spread over 611 lockfiles because every integration pins its own environment. llama-index-core's lockfile has one high. The 17 criticals sit in 14 integration packages, such as the Lilac and ServiceNow readers, the Guardrails output parser and the Chroma and Zep stores, which you only get by installing that package.
• 14 workflows; the one using pull_request_target closes new-integration pull requests and does not check out their code. None of the 16 third-party actions is pinned to a commit. Security policy, Dependabot, CodeQL, contributing guide and code of conduct all present.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: Python 457.9K, Jupyter 355.4K, HTML 226.5K, Markdown 97.8K, TOML 41.9K, JavaScript 17.3K.

Questions

Is LlamaIndex free?

Yes. The framework and all its integration packages are MIT-licensed and free for commercial use. LlamaParse, the company's hosted document parsing and extraction service, is a separate paid product with a free allowance. The framework works without it, using its own readers or open-source parsers.

LlamaIndex or LangChain?

Both can build RAG apps and agents, and they interoperate. LlamaIndex starts from the data: loaders, indexes, retrievers and query engines, with sensible defaults for document question answering. LangChain starts from the model and agent loop, with retrieval as one component. For search over your own documents LlamaIndex is often less code; for tool-heavy agents LangChain has the larger ecosystem.

Can LlamaIndex run without OpenAI?

Yes. OpenAI is only the default in examples. Install llama-index-llms-ollama and llama-index-embeddings-huggingface, set them as the model and embedder in Settings, and the whole pipeline, from embedding to answering, runs on your own machine with no API key. The first run downloads the embedding model from Hugging Face.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.